News for hackers. Stuff that matters.
Re:Thunderbird 78.x is great but has issues for advanced PGP... by im3w1l on Thursday November 26, 2020 @11:56PM (#25225648)
Which version of HTML is used for email? No javascript for instance right? Possible to make a reduced parser for which it is easier to verify correctness?
Re:Thunderbird 78.x is great but has issues for advanced PGP... by jcranmer on Friday November 27, 2020 @12:55AM (#25225857)
Thunderbird renders HTML using the same rendering engine as Firefox, although the email doesn't use the HTML5 doctype (so it's quirks mode), and several features are disabled (e.g., JS, frames).

There's been a couple of working groups that have attempted to standardize HTML support in email, but they don't get very far on account of having almost no representation from anyone who actually works on email clients (on account of most of the interest being email marketers who want to complain about HTML support).

The actual support for HTML is probably these days mostly HTML5 (in terms of the actual parsing algorithm), with several elements unsupported, and the CSS support being very spotty. Many MUAs are using whitelists of elements to support (don't expect <video> to make it through, and especially not <iframe>), and scrubbing CSS themselves with whitelists. In effect, this means that virtually everything added in HTML5 probably won't work, so the support is more akin to HTML4 in that regard. Infamously, Outlook uses the same HTML rendering engine as Word, which is (was?) based on the IE 5.5 rendering engine.

Re:Thunderbird 78.x is great but has issues for advanced PGP... by freeone3000 on Friday November 27, 2020 @12:00AM (#25225667)
There is no standard HTML version for email, the same way there is no standard HTML version for a website. The contents can reasonably be anything.
Re:Thunderbird 78.x is great but has issues for advanced PGP... by im3w1l on Friday November 27, 2020 @12:05AM (#25225682)
Follow up question: What parts of html do you need implement to render 99% of emails decently accurately?
Re:Thunderbird 78.x is great but has issues for advanced PGP... by freeone3000 on Friday November 27, 2020 @12:10AM (#25225693)
For a very long time, the limit was Outlook on Windows, which used the Word 2003 parser. So, whatever was supported by Word 2003.

But, more recently, mail campaigns have instead targeted Gmail, so "whatever Gmail renders" (this is not everything a browser renders, but is close). It's not feasible to implement a subset for this and do parallel CVE fixes.

Re:Thunderbird 78.x is great but has issues for advanced PGP... by emilsedgh on Friday November 27, 2020 @12:21AM (#25225719)
Unfortunately Outlook has a pretty big market share in corporate world and if you're serious about your emails, you still have to support it.

It's worse than IE6. And to help your sanity, use mjml.

Re:Thunderbird 78.x is great but has issues for advanced PGP... by young_unixer on Friday November 27, 2020 @03:24AM (#25226554)
Or just don't send weird shit in emails.
Re:Thunderbird 78.x is great but has issues for advanced PGP... by krageon on Friday November 27, 2020 @04:01AM (#25226771)
Email html rendering is a giant pile of steaming dino dung. No matter how you implement it, you will absolutely break emails.
Re:Thunderbird 78.x is great but has issues for advanced PGP... by jankotek on Friday November 27, 2020 @01:56AM (#25226142)
Thunderbird has simplified html viewer, no css etc, works pretty well.